Stop Saying, ‘We Take Your Privacy and Security Seriously’

242 点作者 samaysharma超过 6 年前

22 条评论

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /sNote to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family).The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget.Nah. I'll skip as always :D

评论 #19215699 未加载

评论 #19215554 未加载

评论 #19215632 未加载

评论 #19215713 未加载

评论 #19217077 未加载

评论 #19216517 未加载

评论 #19217211 未加载

评论 #19215564 未加载

评论 #19227855 未加载

评论 #19219490 未加载

评论 #19216342 未加载

评论 #19215577 未加载

评论 #19217378 未加载

atoav超过 6 年前

Say it, when you do. Say: We take your Privacy and Security seriously that is why we won’t ever store a tracking cookie on your machine. If you still want to support us by different means, click hereAnybody who takes your privacy seriously won’t even have to ask for consent, because there is nothing to ask for

评论 #19215425 未加载

resonanttoe超过 6 年前

This is slightly off topic and relatively minor, but man does it represent the piss poor state of Tech writers and their articles."I was curious how often this go-to one liner was used. I scraped every reported notification to the California attorney general, a requirement under state law in the event of a breach or security lapse, stitched them together, and converted it into machine-readable text.About one-third of all 285 data breach notifications had some variation of the line."Don't bother providing a link to either you data source or your code, the ability for someone to independently verify the validity of this claim and its results isn't important, we'll just "trust" you.

评论 #19216420 未加载

评论 #19216541 未加载

评论 #19215872 未加载

dalbasal超过 6 年前

The ironies of reading articles about the pathologies of the 2019 digital economy are... well...The publications where you might read about the problem are likely contributers to it.From the EU, before you read about companies abusing your privacy you first go through their "consent" page, maliciously designed to prevent readers from preventing "the Oauth family" from giving whatever data they can get on you to advertisers.Then you get to read the article:"I’ve never understood exactly what it means when a company says it values my privacy. If that were the case, data hungry companies like Google and Facebook, which sell data about you to advertisers, wouldn’t even exist."... TC's modus operandi & business model appears to be the same.On many occasions I have read an article bemoaning fake news that was framed by "native ads," pretending to be articles, and promoting fake science (one wierd trick), apocalypse cults and worse.

评论 #19216014 未加载

scotty79超过 6 年前

‘We Take Your Privacy and Security. Seriously.’

评论 #19215588 未加载

kkm超过 6 年前

Lot of companies are shooting themselves in their own foot by sharing critical data with a plethora of third-parties.They put sensitive information like username, orderid in the URL which is then shared with all the third-parties on that page, simply because referrers are not sanitized.This happens:- Without user-consent- More dangerously without the companies knowing it too.On reporting, the companies do not want to fix these issues.Shameless plug: You can find some of such cases, which I've been trying to highlight to the companies:- <a href="https://medium.freecodecamp.org/how-airlines-dont-care-about-your-privacy-case-study-emirates-com-6271b3b8474b" rel="nofollow">https://medium.freecodecamp.org/how-airlines-dont-care-about...</a>- <a href="https://threatpost.com/def-con-2018-telltale-urls-leak-pii-to-dozens-of-third-parties/134960/" rel="nofollow">https://threatpost.com/def-con-2018-telltale-urls-leak-pii-t...</a>- <a href="https://cliqz.com/en/magazine/lufthansa-data-leak-what-a-single-url-can-reveal-about-you" rel="nofollow">https://cliqz.com/en/magazine/lufthansa-data-leak-what-a-sin...</a>- <a href="https://fosdem.org/2019/schedule/event/web_extensions_exposing_privacy_leaks/" rel="nofollow">https://fosdem.org/2019/schedule/event/web_extensions_exposi...</a>

lagadu超过 6 年前

Ohh something related to my area! I work with security/data management and often I get to have access to client organizations for a variety of reasons; most of our clients are banks, pharmaceuticals and pension funds, among others."We take your privacy and security seriously" from some rando company doesn't even make me roll my eyes because of how desensitized I am to that whole concept. It's genuinely appalling how often banks have no clue of who has access to what data inside their organization: tons of people having accesses they shouldn't and nobody keeps track of it? Of course. Database copies stored in random hard drives sitting on tables? Why, naturally! Attestation processes? What's that? We're not talking about small entities either. These people would be years away from something not too hard like an iso27001 certification.In short: all of our data is in an incredibly precarious situation and we're fucked forever. I don't get outraged at leaks nowadays, I just laugh at it.edit: interestingly enough, in my experience pharmas care far more about data security than banks do (I assume that is because they have more shit to hide).

nightcracker超过 6 年前

You enter a coffee shop. Before you can do anything, the owner takes a photo of you, and grabs your hand to take your finger print. He quickly writes down the date, time and what clothes you are wearing.He gives you a smile as he starts his speech. "Before we continue, we at Coffee City want you to know we deeply value your privacy. We need your permission to store your information, improve your coffee experience, personalize your coffee suggestions and share it with our partners. Do you consent?"You don't fucking value my privacy. I get some serious doublespeak vibes. If you valued my privacy you'd leave me the fuck alone and stop saving information about me.IMO GDPR doesn't go far enough. Even these popups are wasting my valuable time and invade my privacy due to the ease it is to accidentally consent to some stupid bullshit while navigating the 20 windows needed to reject all consent.We should outlaw even asking for consent to store personal information for any user that didn't log into your site. If I do not have an account with you, I'm not your user, we don't have an extended relationship and you have no business storing information about me.

评论 #19216566 未加载

评论 #19216139 未加载

评论 #19217001 未加载

ardfie超过 6 年前

Troy Hunt wrote about this a few years ago, with the pithy headline '“We take security seriously”, otherwise known as “We didn’t take it seriously enough”'<a href="https://www.troyhunt.com/we-take-security-seriously-otherwise/" rel="nofollow">https://www.troyhunt.com/we-take-security-seriously-otherwis...</a>

OliverJones超过 6 年前

I agree. The phrase "we take your privacy and security seriously" is an inherent oxymoron; meaning the opposite of what it says.I really like, and have copied, Tesla's note to security researchers. <a href="https://www.tesla.com/about/security" rel="nofollow">https://www.tesla.com/about/security</a>I had to clean up one breach a few years ago. It was, gulp, a breach of HIPAA-covered health info. We wrote to our customers saying"We're sorry. We unintentionally sent your blahblah sheet to the wrong hospital. We have spoken to the person at that hospital who received it and confirmed that they erased your information. Again, we apologize. If you have questions don't hesitate to call us at xxx-xxx-xxxx"We could have blamed the the third-party vendor who actually made the mistake. We could have spewed oxymorons. But this message was successful and true: nobody sued us and the govt didn't write us up.The breach, admittedly, was only a few dozen records. It could have been much worse.A lesson for tech people: when you have a breach DRAFT THE PUBLIC STATEMENT RIGHT AWAY so you can hand it to your executives and crisis PR people. That way your company has a chance of doing it right.

ausjke超过 6 年前

I must chime in on this subject.To take a community college course, the application online form is asking pretty much every piece of your info, birthday, SSN, family income, ethnicity, future plan, current situation, home address, many personal preference, phone, email, immigration status, marriage status, gender, education background, military background, job experience, you name it. Nearly all of them are mandatory. Anyone can get hold of this record pretty much owns you.Why do they need all this for just taking a course that I'm going to pay by credit card?This is not uncommon in other areas, in the future we may need provide our DNA code as an attachment? talking about privacy protection is a joke these days.

评论 #19217452 未加载

bitwize超过 6 年前

It's right up there with "your call is very important to us" and "best of luck in your future endeavors".

formatkaka超过 6 年前

A question:What is privacy issue exactly about ? I see regular posts on HN about it. Is it about storing user-data on my end or sharing the user-data with third party or not taking the user consent.P.S. - Trying to understand the root cause because I work with a startup building SAAS and would like to avoid such mistakes.

评论 #19215649 未加载

评论 #19215635 未加载

评论 #19216696 未加载

threatofrain超过 6 年前

We take your privacy seriously is the kind of language you'd expect from a company that doesn't want to make specific commitments. That company isn't putting any skin in the game with that claim; every company claims that.Therefore I am not surprised and won't be holding my breath.

cottsak超过 6 年前

I just added security.txt to one of my sites. Great reminder!

jhallenworld超过 6 年前

Weasel words. "That's a great question! Mistakes were made, it's a really hard problem, but we're working on it."

arpinum超过 6 年前

Spent 10 minutes trying to prevent TC / Oath from using my personal data. 5 clicks and proving I'm not a robot before reaching a privacy dashboard. Except, to actually set my preferences to not track me I first need to agree to tracking! And if I don't allow 3rd party cookies to track me I cannot withdraw consent.GDPR was meant to allow users to refuse consent without detriment, and to not to force consent to use the service. Oath clearly violates GDPR, yet regulators have done nothing in 10 months.

Cypher超过 6 年前

Also stop saying "We understand players concerns with [AAA greed mechanic here]"

jrockway超过 6 年前

I read that as "we know you're mad" which seems accurate to me.

amelius超过 6 年前

It's similar to "don't be evil".

BucketSort超过 6 年前

Or at least put a crying face emoji after saying it.

nkkollaw超过 6 年前

LOL, not only does TechCruch say that, but they also infest your session with tracking cookies.Hard pass.

评论 #19215797 未加载